       (:public-key host-keys)
       [])))
 
+;; TODO Add final optional `options' map for :key-length and :extensions
 (defn gen-cert
   [certname ca-cert serial]
   {:pre [(string? certname)

         (integer? serial)]
   :post [(ssl-cert? %)]}
  (let [cert-keys (gen-keys certname)]
    (assoc cert-keys :cert (gen-cert*
                             (dissoc ca-cert :cert)
                             cert-keys
                             serial))))

(defn gen-self-signed-cert
  [certname serial]
  {:pre [(string? certname)


(def key-length 4096)

;; TODO Add final optional `options' map for :key-length
(defn gen-keys
  [certname]
  {:pre [(string? certname)]
